45 lines
1.7 KiB
C
45 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
#pragma once
|
|
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
|
|
#define SSH_AUTH_POLICY_HANDSHAKE_CAPACITY 6U
|
|
#define SSH_AUTH_POLICY_HANDSHAKE_REFILL_US INT64_C(10000000)
|
|
#define SSH_AUTH_POLICY_VERIFICATION_CAPACITY 6U
|
|
#define SSH_AUTH_POLICY_VERIFICATION_REFILL_US INT64_C(10000000)
|
|
#define SSH_AUTH_POLICY_PROBE_CAPACITY 12U
|
|
#define SSH_AUTH_POLICY_PROBE_REFILL_US INT64_C(5000000)
|
|
|
|
typedef enum {
|
|
SSH_AUTH_POLICY_HANDSHAKE,
|
|
SSH_AUTH_POLICY_VERIFICATION,
|
|
SSH_AUTH_POLICY_PROBE,
|
|
SSH_AUTH_POLICY_KIND_COUNT
|
|
} ssh_auth_policy_kind_t;
|
|
|
|
typedef struct {
|
|
int64_t refill_us;
|
|
int64_t last_seen_us;
|
|
uint8_t tokens;
|
|
bool initialized;
|
|
} ssh_auth_policy_bucket_t;
|
|
|
|
typedef struct {
|
|
ssh_auth_policy_bucket_t buckets[SSH_AUTH_POLICY_KIND_COUNT];
|
|
} ssh_auth_policy_t;
|
|
|
|
/* Single-owner only: no allocation, locks, clock reads, timers or sleeps.
|
|
* Start zero-initialized; each class lazily starts at capacity. The owner must
|
|
* retain one shared instance across sessions, stop/start and counter clears;
|
|
* only reboot resets it. Do not modify fields directly or refund admissions.
|
|
* Each true result consumes one token, regardless of subsequent auth outcome.
|
|
* Refill adds one token per class-specific interval, preserving partial credit
|
|
* below capacity and discarding all surplus (including fractions) at capacity.
|
|
* now_us must be nonnegative and nondecreasing across ALL classes (equal is OK).
|
|
* NULL, invalid kind, negative time and regression reject without mutation.
|
|
* An empty-bucket denial records time but never postpones the refill deadline.
|
|
*/
|
|
bool ssh_auth_policy_admit(ssh_auth_policy_t *policy,
|
|
ssh_auth_policy_kind_t kind, int64_t now_us);
|